Sid 39a45121d9 fix(discord,slack): add SSRF policy for media downloads in proxy environments (#25475) ...

* fix(discord,slack): add SSRF policy for media downloads in proxy environments

Discord and Slack media downloads (attachments, stickers, forwarded
images) call fetchRemoteMedia without any ssrfPolicy. When running
behind a local transparent proxy (Clash, mihomo, Shadowrocket) in
fake-ip mode, DNS returns virtual IPs in the 198.18.0.0/15 range,
which the SSRF guard blocks.

Add per-channel SSRF policy constants—matching the pattern already
applied to Telegram on main—that allowlist known CDN hostnames and
set allowRfc2544BenchmarkRange: true.

Refs #25355, #25322

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore(slack): keep raw-fetch allowlist line anchors stable

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

2026-03-01 11:30:10 -06:00

..

monitor

fix(discord,slack): add SSRF policy for media downloads in proxy environments (#25475)

2026-03-01 11:30:10 -06:00

voice

test: bridge discord voice private casts via unknown

2026-02-25 00:31:17 +00:00

accounts.test.ts

Doctor: keep allowFrom account-scoped in multi-account configs

2026-02-26 05:34:58 -05:00

accounts.ts

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

api.test.ts

refactor(test): dedupe agent and discord test fixtures

2026-02-22 20:04:51 +00:00

api.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

audit.test.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

audit.ts

refactor: centralize isPlainObject, isRecord, isErrno, isLoopbackHost utilities (#12926)

2026-02-09 17:02:55 -08:00

chunk.test.ts

refactor(channels): dedupe transport and gateway test scaffolds

2026-02-16 14:59:31 +00:00

chunk.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

client.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

components-registry.ts

Discord: add component v2 UI tool support (#17419)

2026-02-15 21:19:25 -06:00

components.test.ts

Discord: add component v2 UI tool support (#17419)

2026-02-15 21:19:25 -06:00

components.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

directory-live.test.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

directory-live.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

draft-chunking.ts

fix(security): harden account-key handling against prototype pollution

2026-02-24 01:09:31 +00:00

draft-stream.ts

refactor(test): dedupe gateway and web scaffolding

2026-02-22 20:04:51 +00:00

gateway-logging.test.ts

chore: Fix types in tests 39/N.

2026-02-17 15:50:07 +09:00

gateway-logging.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

guilds.ts

refactor(discord): dedupe guild listing

2026-02-15 04:13:14 +00:00

monitor.gateway.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

monitor.gateway.ts

chore: Enable "curly" rule to avoid single-statement if confusion/errors.

2026-01-31 16:19:20 +09:00

monitor.test.ts

fix: harden discord and slack reaction ingress authorization

2026-02-26 01:26:47 +01:00

monitor.tool-result.accepts-guild-messages-mentionpatterns-match.test.ts

test: dedupe gateway browser discord and channel coverage

2026-02-22 17:11:54 +00:00

monitor.tool-result.sends-status-replies-responseprefix.test.ts

test: dedupe gateway browser discord and channel coverage

2026-02-22 17:11:54 +00:00

monitor.tool-result.test-harness.ts

test: annotate harness mocks to avoid TS2742 in CI

2026-02-16 15:19:11 +00:00

monitor.ts

refactor(channels): share channel config matching

2026-01-17 23:03:51 +00:00

pluralkit.test.ts

Discord: add PluralKit sender identity resolver (#5838)

2026-01-31 19:50:06 -06:00

pluralkit.ts

Discord: add PluralKit sender identity resolver (#5838)

2026-01-31 19:50:06 -06:00

probe.intents.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

probe.ts

fix: dedupe probe/token base types (#16986) (thanks @iyoda)

2026-02-15 11:36:54 -06:00

resolve-channels.test.ts

refactor(test): dedupe agent and discord test fixtures

2026-02-22 20:04:51 +00:00

resolve-channels.ts

refactor(discord): dedupe guild listing

2026-02-15 04:13:14 +00:00

resolve-users.test.ts

refactor(test): dedupe agent and discord test fixtures

2026-02-22 20:04:51 +00:00

resolve-users.ts

fix: lazy-load Discord allowlist guilds (#20208) (thanks @zhangjunmengyang)

2026-02-20 20:26:46 -06:00

send.channels.ts

chore: fix formatting on CI-drift files (#22391)

2026-02-20 22:40:30 -05:00

send.components.test.ts

feat: thread-bound subagents on Discord (#21805)

2026-02-21 16:14:55 +01:00

send.components.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

send.creates-thread.test.ts

fix(discord): send initial message for non-forum thread creation (#18117)

2026-02-16 13:48:46 -06:00

send.emojis-stickers.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

send.guild.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

send.messages.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

send.outbound.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

send.permissions.authz.test.ts

test(discord): dedupe guild permission route mocks

2026-02-22 07:44:57 +00:00

send.permissions.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

send.reactions.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

send.sends-basic-channel-messages.test.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

send.shared.ts

refactor(discord): dedupe directory and media send paths

2026-02-22 17:54:51 +00:00

send.test-harness.ts

test: add explicit harness mock types

2026-02-14 16:51:25 -05:00

send.ts

feat: thread-bound subagents on Discord (#21805)

2026-02-21 16:14:55 +01:00

send.types.ts

feat(discord): support forum tag edits via channel-edit (#12070) (thanks @xiaoyaner0201)

2026-02-20 21:17:04 -06:00

send.webhook-activity.test.ts

test(core): trim redundant test resets and use mockClear

2026-02-22 08:12:55 +00:00

targets.test.ts

test(core): reduce reset overhead in messaging and agent e2e mocks

2026-02-22 08:33:06 +00:00

targets.ts

refactor(channels): share prefixed target parsing

2026-02-17 00:32:34 +00:00

test-http-helpers.ts

refactor(test): dedupe agent and discord test fixtures

2026-02-22 20:04:51 +00:00

token.test.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

token.ts

fix: dedupe probe/token base types (#16986) (thanks @iyoda)

2026-02-15 11:36:54 -06:00

ui.ts

Discord: CV2! (#16364)

2026-02-15 10:24:53 -06:00

voice-message.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00